Sub-processors
These are the service providers that process personal data for TokenToko. Each works under a contract that limits what it may do with the data. Our Privacy Policy explains the data itself, and our Data Processing Addendum explains how this list applies to teams.
1. Current sub-processors
In short: nine providers, most of them in the European Union or the UK.
Hetzner Online GmbH
What it does for TokenToko: Runs our servers: the database, the backend, the isolated sign-in containers for connecting subscriptions and our self-hosted email service
Personal data it receives: Account, team, subscription (tokens encrypted), computer, usage and payment records
Where: Germany (EU)
Google Ireland Limited (Firebase and Google Cloud)
What it does for TokenToko: Sign-in with Google, Apple or Microsoft (Firebase Authentication); hosting of the dashboard; storage of service secrets; a copy of our database backups
Personal data it receives: Name, email, profile photo and user ID; dashboard requests and IP addresses; database backups, with subscription tokens encrypted
Where: Netherlands (EU) for hosting; Firebase Authentication may process data in the United States
Cloudflare, Inc.
What it does for TokenToko: Network edge, DNS and the secure tunnel to our servers; approximate location from IP addresses; hosting of downloads and updates; a second, encrypted copy of our database backups
Personal data it receives: IP addresses and request details; encrypted backups
Where: Global network; backups and downloads stored in Western Europe
PostHog Inc.
What it does for TokenToko: Product analytics, session recording and error tracking in the dashboard, when analytics is on
Personal data it receives: User ID, email, name, dashboard activity and session recordings with secrets hidden
Where: European Union (Germany)
Stripe Payments Europe, Ltd. and Stripe, Inc.
What it does for TokenToko: Payments, invoices and fraud prevention
Personal data it receives: Billing name, email, country, payment details and purchase records
Where: Ireland and United States
Amazon Web Services EMEA SARL (Amazon SES)
What it does for TokenToko: Delivering our emails: invitations, alerts and account messages
Personal data it receives: Email address and the content of those emails
Where: United Kingdom (London)
Google Ireland Limited (Google Workspace)
What it does for TokenToko: Our support, privacy and security mailboxes
Personal data it receives: What you send us by email
Where: Global
Framer B.V.
What it does for TokenToko: Hosting tokentoko.ai and counting visits without cookies
Personal data it receives: IP address and page requests
Where: European Union, with a global network
GitHub, Inc.
What it does for TokenToko: Hosting our container image, our Homebrew tap and our npm packages
Personal data it receives: IP address of people who download them
Where: United States and global
2. Not sub-processors
In short: your AI provider works for you, not for us.
Your AI provider, for Claude that is Anthropic, receives the requests your computers send with your subscription tokens, and our token checks. It acts under your own agreement with it, as an independent controller, not as our sub-processor.
Google Fonts delivers the fonts of tokentoko.ai and receives your IP address when the website loads.
3. Changes to this list
In short: 30 days’ notice before a new sub-processor starts.
We update this page before a new sub-processor starts processing personal data. For teams covered by our Data Processing Addendum, we email team owners at least 30 days before the change, so they can object as the addendum describes. Questions: privacy@tokentoko.ai.